Privacy Policy

This Privacy Policy ("Policy") describes how hey HRM and its affiliates ("hey HRM," "we," "us," or "our") collect, use, disclose, and otherwise process personal information in connection with our platform at heyhrm.com, app.heyhrm.com, and jobs.heyhrm.com (collectively, the "Service"), and your rights and choices regarding such information.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, do not use the Service.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, password, company name, job title, and profile photo when you create an employer account. Name, email address, and profile information when you create a candidate account on our job board.
• Candidate Information: Full name, email address, phone number, social media profile URLs (LinkedIn, GitHub, portfolio), saved job preferences, and any other information submitted through job applications or your candidate profile.
• Resumes and Professional Documents: Resumes, CVs, cover letters, and other documents uploaded in PDF or DOCX format. We extract and store the text content of these documents to enable search functionality.
• Assessment Data: Answers, scores, response times, and performance metrics from cognitive ability tests, personality assessments (IPIP-NEO-120), and skill-based assessments.
• Company Information: Company name, website, description, logo, and recruitment pipeline configurations.
• Communications: Messages, feedback, and other communications you send to us, including newsletter subscription email addresses.

1.2 Information Collected Automatically

• Assessment Integrity Data: During assessments, we monitor and record tab switches, window focus changes, copy/paste events, and other behavioral signals to ensure test integrity.
• Device and Browser Information: IP address, browser type, operating system, device type, and user agent string, collected during account creation, application submission, and consent recording.
• Authentication Data: Session tokens, login timestamps, and OAuth provider data (e.g., Google account identifiers).
• Usage Data: Pages visited, features used, actions taken, timestamps, and interaction patterns within the Service.
• Cookies and Similar Technologies: See our Cookie Policy for details.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: Facilitating job postings, candidate applications, assessment delivery, pipeline management, and employer-candidate matching.
• Assessment Scoring and Analysis: Computing cognitive ability scores, personality profiles (Big Five/OCEAN domains and facets), skill assessment results, and integrity evaluations.
• Search and Discovery: Enabling employers to search candidate profiles, resumes, and application data within their organization.
• Communications: Sending transactional notifications (application confirmations, test completions, stage changes), reminders, and marketing communications where permitted.
• Product Improvement: Analyzing usage patterns, assessment performance data, and user feedback to improve, develop, and optimize the Service.
• Aggregated Analytics and Benchmarking: Creating anonymized, aggregated datasets from assessment results, hiring outcomes, and platform usage for benchmarking reports, industry analytics, research publications, and commercial data products.
• Machine Learning and AI Development: Using anonymized and aggregated data to train, improve, and develop machine learning models, algorithms, and artificial intelligence systems, including for use in other products and services.
• Safety and Integrity: Detecting and preventing fraud, cheating, unauthorized access, and other harmful activities.
• Legal Compliance: Complying with applicable laws, regulations, legal processes, and governmental requests.

3. How We Share Your Information

3.1 With Employers

When you apply for a job through the Service, your application information — including name, contact details, resume, assessment scores, personality profiles, and integrity flags — is shared with the employer who posted the vacancy. Employers control their own data retention and usage practices.

3.2 With Service Providers

We share information with third-party service providers who process data on our behalf, including:

• Supabase: Database hosting, authentication, and file storage infrastructure.
• Google: OAuth authentication services.
• LinkedIn: OAuth authentication and profile data import services.
• Cloudflare: Content delivery and web application hosting.

3.3 Aggregated and De-Identified Data

We may share, sell, license, or otherwise distribute aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This includes aggregated assessment benchmarks, hiring trend reports, workforce analytics, and statistical datasets. Such data is not subject to the restrictions of this Policy.

3.4 Business Transfers

In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity or successor.

3.5 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Employer account data: Retained for the duration of the account and a reasonable period thereafter.
• Candidate application data: Retained according to the employer's configured data retention settings, or our default retention period if no configuration is set.
• Assessment results: Retained for the duration necessary to provide the Service. Results may be reused across applications to the same employer to avoid duplicate testing.
• Anonymized and aggregated data: Retained indefinitely, as it cannot be used to identify individuals.

5. Your Rights and Choices

5.1 General Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information, subject to legal and contractual obligations.
• Request portability of your personal information in a machine-readable format.
• Object to or restrict certain processing activities.
• Withdraw consent where processing is based on consent.

To exercise these rights, submit a request through the Service or contact us at privacy@heyhrm.com.

5.2 GDPR Rights (EEA/UK Residents)

If you are located in the European Economic Area or United Kingdom, our legal bases for processing include:

• Contract performance: Processing necessary to provide the Service to employers and facilitate candidate applications.
• Legitimate interests: Product improvement, fraud prevention, analytics, and benchmarking, where these interests are not overridden by your rights.
• Consent: Newsletter subscriptions, optional cookies, and marketing communications.

You have additional rights under the GDPR including the right to lodge a complaint with your local supervisory authority.

5.3 CCPA Rights (California Residents)

Under the California Consumer Privacy Act, California residents have the right to:

• Know the categories and specific pieces of personal information collected.
• Request deletion of personal information.
• Opt out of the sale of personal information.
• Non-discrimination for exercising privacy rights.

We may share aggregated, de-identified data with third parties for commercial purposes. To the extent this constitutes a "sale" under CCPA, you may opt out by contacting privacy@heyhrm.com.

6. Data Security

We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), row-level security policies on our database, role-based access controls, and secure authentication mechanisms. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. By using the Service, you consent to such transfers.

8. Children's Privacy

The Service is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately.

9. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page with a revised "Last updated" date. Your continued use of the Service after any changes constitutes your acceptance of the updated Policy.

10. Contact Us

If you have questions about this Policy or our data practices, contact us at:

hey HRM
Email: privacy@heyhrm.com